The piloting and guidance of an aircraft requires, among other information, knowledge of the speed vector of the aircraft relative to the surrounding air, and knowledge of the barometric altitude.
This knowledge of the speed vector of the aircraft relative to the air is obtained on the basis of a set of probes which provide local measurements of pressure, of orientation of the air stream and of the temperature of the environment air, and which constitute input parameters for determining the speed vector of the aircraft relative to the air and the barometric altitude. This determination implements local aerodynamic corrections (SSEC laws, the acronym standing for “Static Source Error Correction”), which convey the matrix coupling between the local measurements and the true values of the speed vector of the aircraft relative to the surrounding air, and of the barometric altitude.
The speed vector of an aircraft relative to the surrounding air is usually expressed in spherical coordinates in a trihedron or reference frame tied to the aircraft, in the form of three components: the speed TAS of the aircraft relative to the surrounding air, the angle of attack AOA of the aircraft and the angle of sideslip SSA of the aircraft. It can also be expressed in Cartesian coordinates in the reference frame tied to the aircraft, in the form of the three components: VXair, VYair, VZair.
The operating safety of the aircraft requires that the knowledge of the speed vector of the aeroplane relative to the air and the knowledge of the barometric altitude have a sufficient level of reliability and availability.
Usually an aircraft is furnished with several suites of probes which offer physical redundancy. A device for monitoring failures is implemented so that this redundancy is handled in the best way.
Failure detection based on hardware redundancy of sensors of the same design does not make it possible to detect common-mode faults, i.e. a phenomenon capable of simultaneously affecting the proper operation of several sensors. If a fault mode can affect at least half the sensors, then the isolation of the failed sensors is no longer possible. The use of several sensors having dissimilar operating principles makes it possible to reduce the risk of common mode, at the price of increased complexity.
An alternative to physical redundancy is analytical redundancy, which consists in performing an estimation of the value of the parameter measured by a sensor, which is not impacted (or impacted as little as possible) by the failure of the actual sensor.
The estimation of the value of the parameter implements either the expression of a kinematic coupling with other sources of measurements (usually inertial measurements), or the expression of constraints of dynamic change based on flight mechanics, or on a combination of the two schemes (kinematic and dynamic).
The use of a redundancy between a sensor measurement and an estimation has diverse drawbacks.
An observer or estimator of speed of an aircraft relative to the surrounding air, constructed by kinematic coupling with the inertial measurements, can with difficulty eliminate the acceleration of the air relative to the ground. Consequently, such an observer cannot discern a failure of the sensor leading to an error in the speed of the aircraft relative to the surrounding air that is lower than the amplitude of the speed of the surrounding air relative to the ground that would be developed by a strong gust of wind.
An observer or estimator of speed of an aircraft relative to the surrounding air based on flight mechanics requires the knowledge of certain characteristic data of the aircraft (aerodynamic coefficients, mass, moments of inertia, thrust of the engines). Access to this information is not easy. It is possible to identify it in flight (by estimation techniques, explicitly or implicitly) but this operation generally turns out to be tricky.
The basic problem is the stabilization of the estimator so that the estimated measurement provides a faithful replica of reality, without directly using the measurement of the actual sensor, for fear that in case of failure of the sensor, the measurements provided by other sensors (presumed to be reliable) may not stabilize.
The estimator of the speed of an aircraft relative to the surrounding air, with kinematic coupling, with inertial measurements (cf J. C. Deckert et al, 1976, “F-8 aircraft sensor failure identification using analytical redundancy”, IEEE) operates in open-loop and its performance is limited by the uncertainty in the acceleration of the air relative to the ground. To avoid a crippling rate of false alarms (failure detection with each gust of wind), the estimator must be adjusted in a slack manner, thereby prohibiting it from detecting a failure of the sensor leading to an error in the speed of the aircraft relative to the surrounding air that is lower than the amplitude of the speed of the air relative to the ground that would be caused by a strong gust of wind.
The prior art therefore tends to favour observers with dynamic coupling, on principle less sensitive to the motion of the air relative to the ground. The problem is then to ascertain with sufficient accuracy the characteristic data of the aircraft (aerodynamic coefficients, moments of inertia, thrust of the engines, mass) which come into the motion propagation equations.
Diverse techniques (explicit estimation of Kalman filtering type) are known which consist in estimating these data during learning flight phases, by using supposedly reliable sensors and by counting on trajectories offering the required observability. These techniques induce heavy operational constraints.
Other techniques (implicit estimation, such as PCA, the acronym standing for “Principal Component Analysis”, SMI, the acronym standing for “Subspace Model Identification”, or OKID, the acronym standing for “Observer Kalman Identifier”) are also known which consist in estimating a representation of these data (and not the data directly), on-line over a longer or shorter time horizon relative to the current instant. In this case the formal validation of the performance of the observer is difficult since the analytical tie with the physics of the problem, which would have made it possible to reduce a priori the quantity of test cases to be passed in order to demonstrate the missing detection and false alarm rates, is lost.
An aim of the invention is to alleviate these problems.